Questions tagged [signature]

A digital signature proves that the owner of a private key produced or endorsed a given message. These are used in transactions to prove that an output can be spent in a transaction.

Filter by
Sorted by
Tagged with
1 vote
1 answer
43 views

Is the Z value generated before the (r, s) values?

I just want to confirm my understanding of signatures for P2PKH transactions. The signature hash, z, is generated before generating the r and s values of a DER signature, correct?
jiamijiang's user avatar
1 vote
1 answer
41 views

Transaction keep beeing rejected "non-mandatory-script-verify-flag"

I'm developping Bitcoin integration for Microsoft Dynamics Business Central to offer enterprise capability to apply Bitcoin receivable and payable to accounting. To send a transaction, I'm using ...
Maxime CATY's user avatar
2 votes
1 answer
73 views

Why inputs' scriptSig are stripped before the whole transaction being signed?

In this video, the lecturer explains that before the whole transaction get signed, the scriptSig part of inputs are removed, and this causes the ability to perform transaction malleability attacks. My ...
Amir reza Riahi's user avatar
2 votes
1 answer
85 views

Where are transaction signatures beside the scriptSig?

To spend a UTXO, we need to sign it (have the scriptSig). Then we can spend that UTXO to any address we want, which it wasn't included in the signature we produced for unlocking the UTXO. So we should ...
Amir reza Riahi's user avatar
0 votes
0 answers
29 views

What does it mean when R, S values begin with zeroes?

I was hired to fix some typos in a WIF but I went into analyzing transactions instead then I found 3 R values that begin like this: 008505 008391 00a542 Then 2 S values begin like this: S: 00db19 S: ...
terry franklin's user avatar
-1 votes
1 answer
31 views

"Signature must be zero for failed CHECK(MULTI)SIG operation"

I want to broadcast signed transaction but I get this error how can I solve this I get this everytime. "Signature must be zero for failed CHECK(MULTI)SIG operation" RAW hex ...
K. Khurshudyan's user avatar
1 vote
1 answer
233 views

python-bitcoin-utils - sendrawtransaction RPC error: {"code":-25,"message":"bad-txns-inputs-missingorspent"} when trying to broadcast my tx?

I am trying to create a bitcoin transaction to send all of the funds from tb1qj6zz96g8xgrwpgmdlvmkrjlwzz54sf47086yc9 to tb1qxgm8j0cq7tnftef3t563psl56gtmzxanm5c9uy. ...
ChristianOConnor's user avatar
1 vote
2 answers
142 views

Is there a set length that a signature can be?

I'm reading this page which describes the following method of creating a stack: OP_0 <A sig> <B sig> OP_2 <A pubkey> <B pubkey> <C pubkey> OP_3 Sig Stack Pubkey ...
bitcoinluvr6969's user avatar
2 votes
1 answer
81 views

Validation of segwit v0-v1 tx automatically adds OP_CHECKSIG?

When I create a segwit transaction v0 (P2WPKH) or v1 (P2TR key-path spend) I do like that (let's spend a P2TR output): Locking Script (of the P2TR output I'm spending): OP_1 PK_size PK Witness: 1 (...
alemaz98's user avatar
  • 133
0 votes
1 answer
42 views

Continuation question about nonce randomness and verification of the randomness by signing parties

Original: Can a signer recover their own signature's nonce `k`? Note that under normal circumstances it is infeasible to randomly generate the same nonce, so either a non-random nonce has to have ...
Poseidon's user avatar
  • 488
1 vote
1 answer
103 views

Can a signer recover their own signature's nonce `k`?

I am proofreading a blog post about nonce reuse. One point that comes up is whether someone could recover another person's private key if the other user reuses the same nonce. In that context, it was ...
Murch is on strike's user avatar
2 votes
1 answer
103 views

Error validating transaction: unexpected witness payload for non-witness script in a P2TR using script path

I am trying to create a raw transaction P2TR, spending a Taproot UTXO using the script path. I did the following: Create a random private key d and corresponding pubkey P (the internal pubkey) ...
alemaz98's user avatar
  • 133
4 votes
1 answer
271 views

non-mandatory-script-verify-flag (Invalid Schnorr signature) when I try to send a P2TR tx on testnet

I'm learning to create tx from scratch in order to understand better how bitcoin tx works and how they are structured. I learnt to create tx with legacy address, segwit v0 and I am now learning ...
alemaz98's user avatar
  • 133
5 votes
1 answer
311 views

Bitcoin Core file with the signing keys was removed from repo. How is the process supposed to be now?

Yesterday this PR was merged into the Bitcoin repository, and the process described at https://bitcoincore.org/download mentions that to validate the source code, you must download the txt file with ...
decentralized.b's user avatar
1 vote
0 answers
75 views

Is Curve25519 better option than Secp256k1?

Are signatures over Curve25519 better than over Secp256k1 or are there major drawbacks? How do, for instance, EdDSA/Schnorr using Curve25519 compare with ECDSA/Schnorr for Secp256k1?
Son Kaos999's user avatar
4 votes
2 answers
188 views

Signing taproot key-path transaction from rust-bitcoin

I'm trying to make a taproot HTLC using rust-bitcoin for an atomic swap protocol. My plan is that in the "happy case" of my protocol, the coins are spent with the key-path, and then there is ...
rijndael's user avatar
1 vote
0 answers
68 views

Anti-exfil protocol can't be verified on multiple hardware wallets

Regarding the nonce side channel attacks detailed in posts like this one by Blockstream. Which references this mailing list by Pieter Wuille. The idea is to add another layer of protection against a ...
reggieadams's user avatar
1 vote
1 answer
24 views

LN-Channel: Do I have to use new private keys for each HTLCs out of security?

I have a question regarding the security of HTLCs in a LN-channel. In a LN-transaction with multiple HTLCs (routings) to the destination one is using the signature of each node provider so that the ...
Robee's user avatar
  • 11
6 votes
1 answer
371 views

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? Is it faster to verify, say 100 (non-interactively) aggregated BLS ...
Son Kaos999's user avatar
0 votes
1 answer
22 views

Getting a high s value rejection although s < N/2

Using the mempool app on my full node from mynode, when transmitting a raw tx with more than one output I get: non-mandatory-script-verify-flag (Non-canonical signature: S value is unnecessarily high)....
Matthias Russ's user avatar
1 vote
2 answers
86 views

How many digital signatures appear in a block?

I am wondering how many times ECDSA digital signature are used across transactions in one block. Let's take for example Block #735,273. It contains 405 transactions. My understanding is that each ...
Steve's user avatar
  • 13
-1 votes
1 answer
65 views

Question regarding the Z value of bitcoin Transaction

Is there such a value as a negative Z or inverse Z related to the original Z value, which is the double SHA256 of the unsigned tx+01000000. I know there is a negative S value, is there a negative Z as ...
Gwer's user avatar
  • 1
2 votes
1 answer
179 views

Were uncompressed public keys always supported by Bitcoin?

I was wondering when compressed public keys were introduced to bitcoin, then I saw this quote from this answer: The original Bitcoin software didn't use compressed keys only because their use was ...
Darius's user avatar
  • 779
-1 votes
1 answer
76 views

What are Known Bits in a bitcoin Transaction?

How do I know if my signatures has leak/weak signatures? Is there a website or script where I can input my signatures to check for weak/leak Nonce part?
Roy Nahar's user avatar
0 votes
1 answer
47 views

Exploiting the use of signature?

I've just learned signatures and why they're used in blockchain. As I understand there is a key pair that consist of one public key and one private key: Private keys are used to sign a message(...
BooRuleDie's user avatar
1 vote
2 answers
127 views

Can someone calculate my private key if I send the same amount to one address?

If I send the exact same amount to the same address in two separate transactions, can someone calculate my private key from the scriptSig? Will the signature (S) and the message (Z) be same?
jivesh aditya's user avatar
13 votes
1 answer
2k views

Is any 256-bit combination a Bitcoin private key?

I've recently been implementing a simple Bitcoin wallet and some libraries seem to disagree with address derivation from the same WIF private key, and thus wouldn't sign transactions. After that, I ...
kuco 23's user avatar
  • 255
0 votes
0 answers
124 views

Is there software that can scan for reused R-values?

Is there any up-to-date program that can check for reused R-value for a specific Bitcoin address? (I don't want to scan the whole blockchain, just for a particular address.)
Riaan Groenewald's user avatar
1 vote
1 answer
46 views

Why we need to repalce the ScriptSig with the previous ScriptPubKey when calculate the per input signature hash?

I'm reading Programming Bitcoin. And in Chapter7, the author talked about the way how signature hash is calculated by replacing the transaction's ScriptSig with the corresponding previous ScriptPubKey....
Shawn C's user avatar
  • 27
2 votes
1 answer
140 views

How and when were high-s signatures made non-standard?

I was just trying to pin-point which BIP made high-s signatures non-standard. BIP62 proposed it as a new consensus rule, but was withdrawn. I couldn't find it in another BIP.
Murch is on strike's user avatar
0 votes
1 answer
76 views

btc transaction by Digital signature

I have old btc wallet and I have Digital signature but i don't have Private key , Is there any way for withdraw btc from wallet just by Digital signature ?
MrX's user avatar
  • 1
1 vote
1 answer
113 views

Can The Redeem Script Consist Of Only 1 Public Key In P2SH Transactions:

I have a few questions relating to Bitcoin Signatures And P2SH: Why is P2SH used as opposed to other forms? Is it still prevalent today - has SegWit made it redundant or less useful, if not, what is ...
Jamo's user avatar
  • 157
0 votes
1 answer
57 views

Where Is Signature Data Stored In Post-SegWit Transactions?

If i'm correct, i am pretty sure that signature data such as the scriptsigsize and scriptsig is stored outside the Tx_Data of a Bitcoin transaction. But then where is it stored? Is it in the block or ...
Jamo's user avatar
  • 157
1 vote
1 answer
87 views

How is a Bitcoin transaction signed using ECDSA?

I am quite familiar with the way secp256k1 ECDSA works as well as the equations that are utilised. However, I have no idea how this ECDSA applies to signing Bitcoin (SegWit Format) and transferring it ...
Jamo's user avatar
  • 157
2 votes
1 answer
179 views

SegWit signing algorithm and its improvement

I was reading about Segregated Witness upgrade from the book Mastering Bitcoin by Andreas and there were some questions I have not figured out. I am appreciated to get some of your help! A) There was ...
John Pham's user avatar
2 votes
1 answer
337 views

Can the difference be determined between two nonces k1, k2, having a linear relationship if the nonce and private key are unknown, i.e., k2 - k1 = n?

My question is related to weak signature vulnerability testing where a hypothetical attacker does not know the values of the nonce or private key itself, but can determine that the nonce 'k1' is ...
Alfhilðr ínn Seiðkona's user avatar
2 votes
1 answer
251 views

Segwit includes the input amount in the SignatureHash. What possible attack can this prevent?

Legacy transactions only include transaction components in the SignatureHash, but segwit transactions also add the amounts of inputs in the SignatureHash. Quoting from the Mastering Bitcoin Book: ...
The Quantum Physicist's user avatar
1 vote
1 answer
33 views

What is maxsigcachesize?

-maxsigcachesize= Limit sum of signature cache and script execution cache sizes to What is this? What is a sigcache? What happens if it is set low and Can it have a bad effect?
Ben Muircroft's user avatar
2 votes
1 answer
171 views

How to calculate the public key, compute point P and create signature using ECDSA?

I'm quite new to the intricacies of bitcoin cryptography and ECDSA and elliptic curve cryptography has me quite stymied. I am faced with a curve with the equation: y^2 = x^3 + 7 of order N=39 with ...
Raighley's user avatar
1 vote
1 answer
94 views

Cryptographic digital signatures

I have a doubt since the public keys are known to everyone, so someone could falsify a transaction by writing down a deposit from a public address to another public address in a new block and solving ...
Dig's user avatar
  • 11
1 vote
1 answer
85 views

Order of Signatures in Multisig-Scheme

3 Entities (A/B/C) create a collaborative Multisig Wallet (e.g. 2-of-3). A creates an unsigned TX and shares it with B/C. They (B/C) sign and broadcast. Looking at the TX on the network, can A make ...
BTC's user avatar
  • 11
1 vote
1 answer
101 views

Standard library for schnorr signature algorithm

I am trying to create a blockchain demonstration to get used to the technology. The thing is: I want to use Schnorr signatures, but I can't seem to find a library for that, and I want to make sure ...
rafael__bg's user avatar
1 vote
1 answer
33 views

Does signing a message as specified in AOPP incur a fee?

Does signing a message as specified in Address Ownership Proof Protocol (AOPP) incur a fee? I think not - there is nothing written in the specification about broadcasting anything to the Bitcoin ...
John Smith's user avatar
0 votes
1 answer
35 views

Is it Possible to Create Signature Chains for Private Keys to Sign Transactions with? Similar to how Certificate Authorities Use Intermediate Certs?

I am wondering if it is possible to implement this flow with bitcoin private keys, similar to how certificate authorities have a root cert and an intermediate cert used to sign csr's. It would be ...
bobandweave's user avatar
2 votes
1 answer
61 views

Bitcoin transaction inquiry

if suppose a someone offers a prize for anyone that can solve a specific challenge, how will the solver make sure that he/she collects the reward? Does the solver need to send the solution directly to ...
Miyamoto Musashi's user avatar
3 votes
1 answer
289 views

What is the probability of an ECDSA signature being less than 71 bytes

Since DER requires R and s values being minimally encoded signed integers, they could be less than the expected 32 bytes. What is the probability that one or both of R and s are less than 32 bytes for ...
Andrew Chow's user avatar
  • 66.4k
1 vote
3 answers
67 views

Why can't I modify someone else's transactions, if I have their signature data?

As I know, signature system is adding signature to end of transaction. And doesn’t hash transaction, so others can know my signature. If I can send a message directly to the node, can I use other’s ...
Jumo Kang's user avatar
2 votes
2 answers
118 views

What is the relationship between r in signature and the public key

I've been reading about ECDSA in here. Step 11 says that you only need the ‘x‘ value (20 bytes) for the signature, and that value will be called ‘R‘ Does that say that R is the x-coordinate of the ...
KHJUAF403456ZS3K564WAEF's user avatar
1 vote
1 answer
124 views

How long is SIGHASH?

I am reading these two posts 1 2, and following step by step. I almost understand, but I still have some questions. Before signing, input script should be removed and replaced by pre locking script. ...
KHJUAF403456ZS3K564WAEF's user avatar
1 vote
1 answer
94 views

How many times and where exactly is ECDSA used in Bitcoin?

I'm currently a little confused about where exactly ECDSA is used in the transaction process... some resources seem to say it's used once, whereas others seem to say it's used three times. Which is ...
cpp's user avatar
  • 13

1
2 3 4 5
9